Search Results

Search found 43 results on 2 pages for 'tchalvak'.

Page 2/2 | < Previous Page | 1 2 

• How should I set up protection for the database against sql injection when all the php scripts are flawed?

  - by Tchalvak

  I've inherited a php web app that is very insecure, with a history of sql injection. I can't fix the scripts immediately, I rather need them to be running to have the website running, and there are too many php scripts to deal with from the php end first. I do, however, have full control over the server and the software on the server, including full control over the mysql database and it's users. Let's estimate it at something like 300 scripts overall, 40 semi-private scripts, and 20 private/secure scripts. So my question is how best to go about securing the data, with the implicit assumption that sql injection from the php side (e.g. somewhere in that list of 300 scripts) is inevitable? My first-draft plan is to create multiple tiers of different permissioned users in the mysql database. In this way I can secure the data & scripts in most need of securing first ("private/secure" category), then the second tier of database tables & scripts ("semi-private"), and finally deal with the security of the rest of the php app overall (with the result of finally securing the database tables that essentially deal with "public" information, e.g. stuff that even just viewing the homepage requires). So, 3 database users (public, semi-private, and secure), with a different user connecting for each of three different groups of scripts (the secure scripts, the semi-private scripts, and the public scripts). In this way, I can prevent all access to "secure" from "public" or from "semi-private", and to "semi-private" from "public". Are there other alternatives that I should look into? If a tiered access system is the way to go, what approaches are best?

  Read the article

• Blocking apache access via user agent string

  - by Tchalvak

  I've got a scripter who is using a proxy to attack a website I'm serving. I've noticed that they tend to access the site via software with a certain common user agent string (i.e. http://www.itsecteam.com/en/projects/project1_page2.htm "Havij advanced sql injection software" with a user_agent string of Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij). I'm aware that any cracking software worth it's salt will probably be able to modify it's user agent string, but I'm fine with the scripter having to deal with that feature at some point. So, is there any software out there for automatically blocking access & permanently blacklisting by matching user agent strings?

  Read the article

• sudoer scheme to allow useful access to another web developer yet retain future control of a virtual

  - by Tchalvak

  Background: Virtual Private Server I have a virtual private server that I'm looking to host multiple websites on, and provide access to another web developer. I don't care about putting too many constraints on him, though I wouldn't mind isolating the site that he'll be developing from other sites on the server that I will develop. The problem: retain control Mainly what I want is to make sure that I retain control over the server in the future. I want to reserve the ability to create/promote/demote and other administrative functions that don't deal with web software. If I make him an admin, he can sudo su - and become root and remove root control from me, for example. I need him not to be able to: take away other admin permissions change the root password have control over other security/administrative functions I would like him to still be able to: install software (through apt-get) restart apache access mysql configure mysql/apache reboot edit web development configuration type files in /etc/ Other Standard Setups would be happily considered I've never really set up a good sudoers file, so simple example setups would be very useful, even if they're only somewhat similar to the settings that I'm hoping for above. Edit: I have not yet finalized permissions, so standard, useful sudo setups are certainly an option, the lists above are more what I'm hoping I can do, I don't know that that setup can be done. I'm sure that people have solved this type of problem before somehow, though, and I'd like to go with something somewhat tested as opposed to something I've homegrown.

  Read the article

• Secure, simple php faq creating/editing scripts?

  - by Tchalvak

  I'm looking to build a simple site centered around a simple faq system in php. The faq concept is simple, but I want to have an administrative-access backend for editing and creating the entries, and securing a login seems more complex and time-consuming, so I'm looking for suggestions for code to start me off. Does anyone know of any open source php scripts or snippets that would work for administrative login to some php scripts that could be used as a simple faq system? Or both, the faq php code + web administrative access code?

  Read the article

• How to order <script> tags vs. <style> tags in HTML markup for best results.

  - by Tchalvak

  I'm building up my site over at http://royronalds.com, and I'm trying to figure out what order of elements in the <head> makes most sense. Just to take from what I current have, I have: <head> <style> external stylesheet <meta> <title> <link> to favicon <script> for jQuery <script> main javascript for site <script> google analytics, asynchronous script. </head> Are there reasons to order these differently so that load times and other issues happen more smoothly, and if so, what would the ideal order be?

  Read the article

• How can I use "Dependency Injection" in simple php functions, and should I bother?

  - by Tchalvak

  I hear people talking about dependency injection and the benefit of it all the time, but I don't really understand it. I'm wondering if it's a solution to the "I pass database connections as arguments all the time" problem. I tried reading wikipedia's entry on it, but the example is written in Java so I don't solidly understand the difference it is trying to make clear. ( http://en.wikipedia.org/wiki/Dependency_injection ). I read this dependency-injection-in-php article ( http://www.potstuck.com/2009/01/08/php-dependency-injection/ ), and it seems like the objective is to not pass dependencies to an object directly, but to cordon off the creation of an object along with the creation of it's dependencies. I'm not sure how to apply that in a using php functions context, though. Additionally, is the following Dependency Injection, and should I bother trying to do dependency injection in a functional context? Version 1: (the kind of code that I create, but don't like, every day) function get_data_from_database($database_connection){ $data = $database_connection->query('blah'); return $data; } Version 2: (don't have to pass a database connection, but perhaps not dependency injection?) function get_database_connection(){ static $db_connection; if($db_connection){ return $db_connection; } else { // create db_connection ... } } function get_data_from_database(){ $conn = get_database_connection(); $data = $conn->query('blah'); return $data; } $data = get_data_from_database(); Version 3: (the creation of the "object"/data is separate, and the database code is still, so perhaps this would count as dependency injection?) function factory_of_data_set(){ static $db_connection; $data_set = null; $db_connection = get_database_connection(); $data_set = $db_connection->query('blah'); return $data_set; } $data = factory_of_data_set(); Anyone have a good resource or just insight that makes the method and benefit -crystal- clear?

  Read the article

• How can I hash passwords in postgresql?

  - by Tchalvak

  I need to hash some passwords with salt on postgresql, and I haven't been able to find any relevant documentation on how to get that done. So how can I hash passwords (with some salts) in postgresql?

  Read the article

• How can I cast authoritatively in asp classic?

  - by Tchalvak

  In asp classic, the cint() function or procedure or whatever it is won't allow me to cast arbitrary strings, like "bob" or "null" or anything like that. Is there anything that will allow me to simply cast integers, numeric strings, and arbitrary strings to actual integers, with some sane default like 0 for strings?

  Read the article

• Are there any security issues to avoid when providing a email-or-username-can-act-as-username login

  - by Tchalvak

  I am in the process of moving from a "username/password" system to one that uses email for login. I don't think that there's any horrible problem with allowing either email or username for login, and I remember seeing sites that I consider somewhat respectable doing it as well, but I'd like to be aware of any major security flaws that I may be introducing. More specifically, here is the pertinent function (the query_row function parameterizes the sql). function authenticate($p_user, $p_pass) { $user = (string)$p_user; $pass = (string)$p_pass; $returnValue = false; if ($user != '' && $pass != '') { // Allow login via username or email. $sql = "SELECT account_id, account_identity, uname, player_id FROM accounts join account_players on account_id=_account_id join players on player_id = _player_id WHERE lower(account_identity) = lower(:login) OR lower(uname) = lower(:login) AND phash = crypt(:pass, phash)"; $returnValue = query_row($sql, array(':login'=>$user, ':pass'=>$pass)); } return $returnValue; } Notably, I have added the WHERE lower(account_identity) = lower(:login) OR lower(uname) = lower(:login) ...etc section to allow graceful backwards compatibility for users who won't be used to using their email for the login procedure. I'm not completely sure that that OR is safe, though. Are there some ways that I should tighten the security of the php code above?

  Read the article

• I need to parameterize against sql injection in asp classic, what things should I take some time to

  - by Tchalvak

  I can already see that I'm not going to enjoy the experience, but I have to do some sql cleanup on this 1000 file asp classic web-app, and before I get to hacking away at it I'd like to be aware of any major gotchas to watch out for with asp classic/sql parameter preparing/asp whitespace altering. What are some good quick overview resources, and what should I watch out for?

  Read the article

• What is the simplest way (or simplest library) to create a truly secure php mail() function?

  - by Tchalvak

  The mail() function is bad, because it is so permissive with headers that you pretty much can't use it with any user input without subjecting yourself or others to spam. So what is the simplest substitute that can still ensure that it's use is secure? Ideally something that can be included in an external file.

  Read the article

• Are there any security issues to avoid when providing a either-email-or-username-can-act-as-username

  - by Tchalvak

  I am in the process of moving from a "username/password" system to one that uses email for login. I don't think that there's any horrible problem with allowing either email or username for login, and I remember seeing sites that I consider somewhat respectable doing it as well, but I'd like to be aware of any major security flaws that I may be introducing. More specifically, here is the pertinent function (the query_row function parameterizes the sql). function authenticate($p_user, $p_pass) { $user = (string)$p_user; $pass = (string)$p_pass; $returnValue = false; if ($user != '' && $pass != '') { // Allow login via username or email. $sql = "SELECT account_id, account_identity, uname, player_id FROM accounts join account_players on account_id=_account_id join players on player_id = _player_id WHERE lower(account_identity) = lower(:login) OR lower(uname) = lower(:login) AND phash = crypt(:pass, phash)"; $returnValue = query_row($sql, array(':login'=>$user, ':pass'=>$pass)); } return $returnValue; } Notably, I have added the WHERE lower(account_identity) = lower(:login) OR lower(uname) = lower(:login) ...etc section to allow graceful backwards compatibility for users who won't be used to using their email for the login procedure. I'm not completely sure that that OR is safe, though. Are there some ways that I should tighten the security of the php code above?

  Read the article

• How can you indicate files to ignore in svn when using git and the git-svn bridge?

  - by Tchalvak

  There is a master subversion repository that I've cloned a git repo from. I've got a lot of ignored files in my .gitignore that I'd like the svn repository to know about. I know that I can use git svn show-ignored to pull the ignored list from subversion, but how can I do the reverse? Send a list of files to be ignored back to the svn repo? Git version (and git-svn is at the same version): git --version git version 1.7.0.5

  Read the article

• How can I get a iterable resultset from the database using pdo, instead of a large array?

  - by Tchalvak

  I'm using PDO inside a database abstraction library function query. I'm using fetchAll(), which if you have a lot of results, can get memory intensive, so I want to provide an argument to toggle between a fetchAll associative array and a pdo result set that can be iterated over with foreach and requires less memory (somehow). I remember hearing about this, and I searched the PDO docs, but I couldn't find any useful way to do that. Does anyone know how to get an iterable resultset back from PDO instead of just a flat array? And am I right that using an iterable resultset will be easier on memory? I'm using Postgresql, if it matters in this case. . . . The current query function is as follows, just for clarity. /** * Running bound queries on the database. * * Use: query('select all from players limit :count', array('count'=>10)); * Or: query('select all from players limit :count', array('count'=>array(10, PDO::PARAM_INT))); **/ function query($sql_query, $bindings=array()){ DatabaseConnection::getInstance(); $statement = DatabaseConnection::$pdo->prepare($sql_query); foreach($bindings as $binding => $value){ if(is_array($value)){ $statement->bindParam($binding, $value[0], $value[1]); } else { $statement->bindValue($binding, $value); } } $statement->execute(); // TODO: Return an iterable resultset here, and allow switching between array and iterable resultset. return $statement->fetchAll(PDO::FETCH_ASSOC); }

  Read the article

• Secure, simple php faq creating/editing script to base further development off of?

  - by Tchalvak

  I'm looking to build a simple site centered around a simple faq system in php. The faq concept is simple, but I want to have an administrative-access backend for editing and creating the entries, and securing a login seems more complex and time-consuming, so I'm looking for suggestions for code to start me off. Does anyone know of any open source php scripts or snippets that would work as base code for administrative login to some php scripts that could be used as a simple faq system? Or base code for both, the faq php code + web administrative access code?

  Read the article

• In asp classic: How can I make sure that a variable can be cast as an int?

  - by Tchalvak

  The following function was suggested to me: ' Defines a forced casting function, which "casts" anything that it can't detect as a number to zero. Function MakeInteger(val) If IsNumeric(val) Then MakeInteger = CInt(val) Else MakeInteger = 0 End If End Function Unfortunately there appear to be some things that return true for IsNumeric() but still can't be cast as an int. Is there any better check to use?

  Read the article

• Security benefits from a second opinion, are there flaws in my plan to hash & salt user passwords vi

  - by Tchalvak

  Here is my plan, and goals: Overall Goals: Security with a certain amount of simplicity & database-to-database transferrability, 'cause I'm no expert and could mess it up and I don't want to have to ask a lot of users to reset their passwords. Easy to wipe the passwords for publishing a "wiped" databased of test data. (e.g. I'd like to be able to use a postgresql statement to simply reset all passwords to something simple so that testers can use that testing data for themselves). Plan: Hashing the passwords Account creation records the original email that an account is created with, forever. A global salt is used, e.g. "90fb16b6901dfceb73781ba4d8585f0503ac9391". An account specific salt, the original email the account was created with, is used, e.g. "[email protected]". The users's password is used, e.g. "password123" (I'll be warning against weak passwords in the signup form) The combination of the global salt, account specific salt, and password is hashed via some hashing method in postgresql (haven't been able to find documentation for hashing functions in postgresql, but being able to use sha-2 or something like that would be nice if I could find it). The hash gets stored in the database. Recovering an account To change their password, they have to go through standard password reset (and that reset email gets sent to the original email as well as the most recent account email that they have set). Flaws? Are there any flaws with this that I need to address? And are there best practices to doing hashing fully within postgresql?

  Read the article

• What is the simplest way to implement an instant messaging contact page on my website?

  - by Tchalvak

  I'd like to have a page that communicates directly to some IM service that I will generally be able to be logged into. E.g. I am on gtalk all the time, I'd like people to be able to get in touch with me via the website. (the specific protocol isn't that important, of course) What would be the simplest set of technologies to implement that?

  Read the article

< Previous Page | 1 2